vulnwire
9.8crit

CVE-2016-3088KEVin critical feed2 exploits

Improper Input Validation in Apache ActiveMQ

Also known as GHSA-rxqh-fc23-gxp2

Published 10 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2022-02-10
EPSS
98.4%
percentile 100%
Public exploits
2
Exploit-DB

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-08-10 (4 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
Apache / ActiveMQ
CISA name
Apache ActiveMQ Improper Input Validation Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

98.37% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-42283 ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit) · remote · 2017-06-29
  • EDB-40857 Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution · remote · 2015-08-17

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.activemq:activemq-client
>=5.0.0, <5.14.0
5.14.0

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type
  • CWE-20 Improper Input Validation

References

  • zerodayinitiative.com /advisories/ZDI-16-356 · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/42283/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • zerodayinitiative.com /advisories/ZDI-16-357 · x_refsource_MISC, x_transferred
  • activemq.apache.org /security-advisories.data/CVE-2016-3088-announcement.txt · x_refsource_CONFIRM, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2036.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securitytracker.com /id/1035951 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.apache.org /thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activem · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apach · mailing-list, x_refsource_MLIST, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088 · government-resource
  • nvd.nist.gov /vuln/detail/CVE-2016-3088 · advisory
  • github.com /apache/activemq/commit/3dd86d04e8b90ba309819317d19e7260d414d9e7 · web
  • issues.apache.org /jira/browse/AMQ-6276 · web
  • lists.apache.org /thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq. · web
  • lists.apache.org /thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a@%3Cusers.activemq.ap · web
  • lists.apache.org /thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache. · web
  • stackoverflow.com /questions/67140241/configuring-activemq-webconsole-to-redirect-http-to-https · web
  • exploit-db.com /exploits/42283 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.